CVE-2018-25015: Use After Free
An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058b8.
Other sources
In sctpwaitforsndbuf of socket.c, there is a possible use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2021-11-05
Event History
Frequently Asked Questions
What is CVE-2018-25015?
CVE-2018-25015 is a use-after-free vulnerability in the Linux kernel before version 4.14.16.
How severe is CVE-2018-25015?
CVE-2018-25015 has a severity rating of 7.8 (High).
What software is affected by CVE-2018-25015?
The Linux kernel versions before 4.14.16 are affected by CVE-2018-25015.
How can I fix CVE-2018-25015?
To fix CVE-2018-25015, update your Linux kernel to version 4.14.16 or higher.
Where can I find more information about CVE-2018-25015?
You can find more information about CVE-2018-25015 at the following references: [link1], [link2], [link3].